Skip to content
OpenAdvisories
High WID-SEC-2026-3177 7 CVEs

Kibana: Mehrere Schwachstellen

Published Sep 3, 2026 · Updated Sep 3, 2026 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service herbeizuführen, sowie um Daten zu manipulieren oder offenzulegen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 7

  • High 8.1
    CVE-2026-78583

    Incorrect Authorization in Kibana Leading to Privilege Escalation

    Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials f…

    Elastic Kibana
  • High 8.1
    CVE-2026-82302

    Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

    Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

    Elastic Kibana
  • Medium 6.5
    CVE-2026-82299

    Incorrect Authorization in Kibana Leading to Information Disclosure

    Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

    Elastic Kibana
  • Medium 4.3
    CVE-2026-78593

    Improper Control of Generation of Code in Kibana Leading to Privilege Escalation

    An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch i…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-78595

    Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

    Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-78596

    Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations

    Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-82298

    Incorrect Authorization in Kibana Leading to Denial of Service

    Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References